Filter for client IP in RDSH sessions

Planned

Clark Haslam

• June 20, 2025 20:23

need to be able to filter by the client IP being in a specific range on a RDSH but the filters only include "view client IP" which is meant for single connection and does not work for RDSH and multi-connection environment. 

0

• Official comment

  

  Steven Hajek

  • June 20, 2025 20:46

  Hi Clark, thank you for the feedback and note about the View Client IP not applying to RDS-based cases!  We have a "TS Client IP" Filter Condition set for our next release.  At the time of writing, this will be 6.9.5, due in Q4 this year. 

  In the mean time, you may be able to use the PowerShell Filter Condition to call a script that does something to this effect:  (its one long line/cmd)

  (Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational'; ID=1149; StartTime=(Get-Date).AddDays(-31);} | ForEach-Object {[PSCustomObject] @{User=$.Properties[0].Value; IPAddress=$.Properties[2].Value; TimeCreated=$_.TimeCreated;}} | Where-Object User -eq $env:USERNAME | Sort-Object -Property TimeCreated -Descending | Select-Object -First 1).IPAddress

  Hope this helps!

Please sign in to leave a comment.